1. How things go wrong. The lucky one and the unlucky one Dr. Stefan Lüders (CERN Computer Security Officer) 3 rd (CS) 2 /HEP Workshop, Grenoble (France) October 9 th, 2011

2. Dr. Stefan Lüders (CERN IT/CO) DESY 20. Februar 2007 How things go wrong. Dr. Stefan Lüders 3 rd CS2HEP October 9 th 2011 The Lucky One

3. Dr. Stefan Lüders (CERN IT/CO) DESY 20. Februar 2007 How things go wrong. Dr. Stefan Lüders 3 rd CS2HEP October 9 th 2011 The SCADA Researcher A month earlier, the Researcher reported to the U.S. Department of Homeland Security who informed us via SWITCH and MELANI.

4. Dr. Stefan Lüders (CERN IT/CO) DESY 20. Februar 2007 How things go wrong. Dr. Stefan Lüders 3 rd CS2HEP October 9 th 2011 What happened?

5. Dr. Stefan Lüders (CERN IT/CO) DESY 20. Februar 2007 How things go wrong. Dr. Stefan Lüders 3 rd CS2HEP October 9 th 2011 Counter-Measures Standard event response: Inform stakeholders Prepare press statement Take documents offline incl. Google cache Change passwords on all instances (can be costly!) Check access logs for unauthorized activity: Weve been able to identify the corresponding actions, e.g. the original scan for the document and WTS accesses Lessons Learned: Starting to block access from the Internet for selected service accounts (i.e. non-personal accounts) Working on a general policy prohibiting service accounts on LXPLUS and CERNTS

6. Dr. Stefan Lüders (CERN IT/CO) DESY 20. Februar 2007 How things go wrong. Dr. Stefan Lüders 3 rd CS2HEP October 9 th 2011 The Unlucky One

7. Dr. Stefan Lüders (CERN IT/CO) DESY 20. Februar 2007 How things go wrong. Dr. Stefan Lüders 3 rd CS2HEP October 9 th 2011 The Attack

8. Dr. Stefan Lüders (CERN IT/CO) DESY 20. Februar 2007 How things go wrong. Dr. Stefan Lüders 3 rd CS2HEP October 9 th 2011 Counter-Measures Standard event response: Inform stakeholders Prepare press statement Check network logs and attacker Ips Forensics of compromised server Difficult if local admins already have tampered with the data Determination of compromise extent Reinstallation after all (painful) Lessons Learned: Patching is a must Central syslogging is a must, too Adequate security training is beneficial for all (Once bitten, twice shy ) Deployment of so-called Security Baselines

9. Dr. Stefan Lüders (CERN IT/CO) DESY 20. Februar 2007 How things go wrong. Dr. Stefan Lüders 3 rd CS2HEP October 9 th 2011 Security Baselines …define basic security objectives …are simple, pragmatic & complete, and do not imply technical solutions All systems/services must be implemented and deployed in compliance with their corresponding Security Implementation Document Non-compliance will ultimately lead to reduced network connectivity (i.e. closure of CERN firewall openings, ceased access to other network domains, full disconnection from the network). Today, we have Security Baselines… …for servers (EDMS 1062500)EDMS 1062500 …for file hosting services (EDMS 1062503)EDMS 1062503 …for web hosting services (EDMS 1062502)EDMS 1062502 …for Industrial Embedded Devices (EDMS 1139163)EDMS 1139163

10. Dr. Stefan Lüders (CERN IT/CO) DESY 20. Februar 2007 How things go wrong. Dr. Stefan Lüders 3 rd CS2HEP October 9 th 2011 Prevention is the key Training & Awareness Dedicated training courses on Secure programming in Java/PHP/Perl/Python and …for Web applications Mandatory on-line security course every two years for all CERN account owners Awareness poster campaign through-out CERN Check out at http://cern.ch/security/training/en/index.shtml Consulting & Assistance Helping system owners with securing their services Website scanning …plus Nessus…

11. Dr. Stefan Lüders (CERN IT/CO) DESY 20. Februar 2007 How things go wrong. Dr. Stefan Lüders 3 rd CS2HEP October 9 th 2011 Thank you! Questions?